{"id":2079,"date":"2026-08-12T16:59:52","date_gmt":"2026-08-12T14:59:52","guid":{"rendered":"https:\/\/www.hagiotopia.com\/?page_id=2079"},"modified":"2026-08-12T16:59:52","modified_gmt":"2026-08-12T14:59:52","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/www.hagiotopia.com\/?page_id=2079","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<p>PRIVACY POLICY \u2014 HAGIOTOPIA<\/p>\n<p>Last updated: 12 August 2026<\/p>\n<h1>1. Purpose<\/h1>\n<p>This Policy explains how Hagiotopia collects and processes personal data relating to Website visitors, prospects, travellers, participants and business contacts.<\/p>\n<p>The applicable framework includes Regulation (EU) 2016\/679 (GDPR), Greek Law 4624\/2019 and, for electronic communications, Greek Law 3471\/2006.<\/p>\n<h1>2. Controller<\/h1>\n<p>[HAGIOTOPIA LEGAL NAME]<\/p>\n<p>Address: [TO BE COMPLETED, GREECE]<\/p>\n<p>AFM: [TO BE COMPLETED]<\/p>\n<p>Privacy email: [TO BE COMPLETED]<\/p>\n<p>DPO, if appointed: [TO BE COMPLETED]<\/p>\n<h1>3. Data we may process<\/h1>\n<p>Depending on your relationship with Hagiotopia:<\/p>\n<ul>\n<li>identity: name, surname, title, date of birth where necessary;<\/li>\n<li>contact information: address, email, telephone;<\/li>\n<li>booking data: trip, dates, participants, room and preferences;<\/li>\n<li>data necessary for formalities: nationality, passport or travel document data where necessary;<\/li>\n<li>payment and billing data; full card details may be processed directly by the payment provider;<\/li>\n<li>communications and requests sent to Hagiotopia;<\/li>\n<li>technical data: IP address, logs, device, browser and cookie data according to your choices;<\/li>\n<li>information concerning special requirements, potentially including health data where necessary and lawful;<\/li>\n<li>information relating to a claim or assistance case where necessary.<\/li>\n<\/ul>\n<h1>4. Purposes and legal bases<\/h1>\n<p>Hagiotopia may process data:<\/p>\n<ol>\n<li>a) to respond to enquiries and take pre-contractual steps;<\/li>\n<li>b) to enter into and perform the travel contract;<\/li>\n<li>c) to manage payments, invoices, bookings, transport, accommodation, visits and assistance;<\/li>\n<li>d) to comply with legal, accounting, tax, tourism, safety or public-authority obligations;<\/li>\n<li>e) to establish, exercise or defend legal claims based on legitimate interests or applicable obligations;<\/li>\n<li>f) to secure the Website and prevent fraud on the basis of legitimate interests;<\/li>\n<li>g) to send marketing communications where consent is required or otherwise as permitted by law;<\/li>\n<li>h) to measure audience or use non-essential trackers on the basis of consent where required.<\/li>\n<\/ol>\n<h1>5. Special category data<\/h1>\n<p>Information revealing health is special category data. Hagiotopia limits collection to what is necessary and processes such data only where a lawful basis and, where relevant, an Article 9 GDPR condition apply, for example explicit consent where appropriate or another legally permitted condition.<\/p>\n<h1>6. Data about other travellers<\/h1>\n<p>If you provide information about other participants, you must be authorised to disclose it and provide them with relevant information about how their data are processed.<\/p>\n<h1>7. Recipients<\/h1>\n<p>Data may be shared as necessary with:<\/p>\n<ul>\n<li>authorised Hagiotopia staff and representatives;<\/li>\n<li>hotels and accommodation providers;<\/li>\n<li>carriers;<\/li>\n<li>guides, tour leaders and activity providers;<\/li>\n<li>partner agencies or destination management companies;<\/li>\n<li>payment providers and banks;<\/li>\n<li>IT, hosting, email and management service providers;<\/li>\n<li>BIRIS, insurer(s), assistance companies and claims handlers where necessary;<\/li>\n<li>professional advisers;<\/li>\n<li>public authorities where legally required.<\/li>\n<\/ul>\n<p>Each recipient receives only data necessary for its role, subject to its own legal obligations.<\/p>\n<h1>8. Transfers outside the European Economic Area<\/h1>\n<p>Some trips or suppliers may require data transfers outside the EEA. Where required by the GDPR, Hagiotopia uses an appropriate transfer mechanism such as an adequacy decision, Standard Contractual Clauses or another recognised safeguard. Where a transfer is necessary for performance of a contract or pre-contractual measures requested by the individual, relevant statutory derogations may also apply.<\/p>\n<h1>9. Retention periods<\/h1>\n<p>Data are retained for periods proportionate to their purpose:<\/p>\n<ul>\n<li>enquiries without booking: [TO BE COMPLETED, e.g. 2 years after last contact];<\/li>\n<li>customer files and contracts: for the relationship and thereafter as necessary for legal obligations and limitation periods;<\/li>\n<li>accounting\/tax records: for periods required by Greek law;<\/li>\n<li>marketing data: [TO BE COMPLETED] or until consent is withdrawn\/objection exercised where applicable;<\/li>\n<li>cookies: as stated in the Cookie Policy;<\/li>\n<li>dispute data: until closure and expiry of relevant limitation periods.<\/li>\n<\/ul>\n<p>An internal retention schedule should be approved with Greek legal\/accounting advisers.<\/p>\n<h1>10. Security<\/h1>\n<p>Hagiotopia implements technical and organisational measures appropriate to risk, including access controls, restricted permissions, backups and system security measures. No system can guarantee zero risk.<\/p>\n<h1>11. Your rights<\/h1>\n<p>Subject to the GDPR, you may request:<\/p>\n<ul>\n<li>access;<\/li>\n<li>rectification;<\/li>\n<li>erasure;<\/li>\n<li>restriction;<\/li>\n<li>portability where applicable;<\/li>\n<li>objection to processing based on legitimate interests;<\/li>\n<li>withdrawal of consent at any time without affecting prior lawful processing;<\/li>\n<li>information about safeguards for certain international transfers.<\/li>\n<\/ul>\n<p>Rights requests may be sent to [PRIVACY EMAIL]. Proof of identity may be requested only where necessary to verify identity.<\/p>\n<h1>12. Complaint to the supervisory authority<\/h1>\n<p>You may lodge a complaint with the Hellenic Data Protection Authority (\u0391\u03c1\u03c7\u03ae \u03a0\u03c1\u03bf\u03c3\u03c4\u03b1\u03c3\u03af\u03b1\u03c2 \u0394\u03b5\u03b4\u03bf\u03bc\u03ad\u03bd\u03c9\u03bd \u03a0\u03c1\u03bf\u03c3\u03c9\u03c0\u03b9\u03ba\u03bf\u03cd \u03a7\u03b1\u03c1\u03b1\u03ba\u03c4\u03ae\u03c1\u03b1), without prejudice to any other administrative or judicial remedy.<\/p>\n<h1>13. Marketing<\/h1>\n<p>Electronic marketing communications are sent in accordance with the GDPR and Greek Law 3471\/2006. Where consent is required, it may be withdrawn at any time. Relevant communications must provide an unsubscribe mechanism.<\/p>\n<h1>14. Minors<\/h1>\n<p>Hagiotopia processes minors\u2019 data only where necessary for travel arrangements and in accordance with applicable legal requirements. Required information and authorisations are obtained from authorised persons where legally required.<\/p>\n<h1>15. Cookies<\/h1>\n<p>Information about cookies, trackers, purposes, retention and consent choices is provided in the Cookie Policy.<\/p>\n<h1>16. Changes<\/h1>\n<p>This Policy may be updated. The latest update date appears above. Material changes are communicated where required by law.<\/p>\n<h1>17. Contact<\/h1>\n<p>Hagiotopia \u2014 Data Protection<\/p>\n<p>Address: [TO BE COMPLETED]<\/p>\n<p>Email: [TO BE COMPLETED]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PRIVACY POLICY \u2014 HAGIOTOPIA Last updated: 12 August 2026 1. Purpose This Policy explains how Hagiotopia collects and processes personal&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_gspb_post_css":"","_uag_custom_page_level_css":"","footnotes":""},"class_list":["post-2079","page","type-page","status-publish","hentry"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"blog-thumb":false,"blog-thumb-vertical":false,"blog-thumb-2column-sidebar":false,"blog-thumb-widget":false},"uagb_author_info":{"display_name":"Ioannis","author_link":"https:\/\/www.hagiotopia.com\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":"PRIVACY POLICY \u2014 HAGIOTOPIA Last updated: 12 August 2026 1. Purpose This Policy explains how Hagiotopia collects and processes personal...","_links":{"self":[{"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/pages\/2079","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2079"}],"version-history":[{"count":1,"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/pages\/2079\/revisions"}],"predecessor-version":[{"id":2081,"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=\/wp\/v2\/pages\/2079\/revisions\/2081"}],"wp:attachment":[{"href":"https:\/\/www.hagiotopia.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2079"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}